Helps align project security implementations with the NIST CSF 2.0 framework.
Install
mkdir -p .claude/skills/nist-csf && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/10494" && unzip -o skill.zip -d .claude/skills/nist-csf && rm skill.zipInstalls to .claude/skills/nist-csf
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Map security controls to NIST Cybersecurity Framework 2.0 functions - Govern, Identify, Protect, Detect, Respond, RecoverKey capabilities
- →Map security controls
- →Maintain asset inventory
- →Conduct risk assessments
- →Implement incident response
How it works
Maps security controls to the six NIST CSF functions to ensure complete cybersecurity coverage.
Inputs & outputs
When to use nist-csf
- →Audit project security controls
- →Map security implementation to NIST
- →Create an incident response plan
About this skill
NIST Cybersecurity Framework 2.0 Skill
Purpose
Map security implementations across all Hack23 projects to NIST CSF 2.0 framework functions and categories, ensuring comprehensive cybersecurity coverage aligned with the organization's risk profile.
Rules
CSF Core Functions
MUST address all six CSF 2.0 functions:
GOVERN (GV) - Organizational Context
- MUST maintain organizational cybersecurity strategy
- MUST define risk management strategy and appetite
- MUST establish cybersecurity supply chain risk management
- MUST maintain roles, responsibilities, and authorities
IDENTIFY (ID) - Asset & Risk Management
- MUST maintain inventory of all assets (repositories, infrastructure, data)
- MUST conduct risk assessments annually and after significant changes
- MUST identify and document all data flows and processing activities
- MUST assess improvement opportunities based on lessons learned
PROTECT (PR) - Safeguards
- MUST implement identity management and access control
- MUST enforce data security (encryption at rest and in transit)
- MUST maintain platform and infrastructure security
- MUST implement technology infrastructure resilience
DETECT (DE) - Monitoring
- MUST implement continuous security monitoring
- MUST analyze adverse events for potential incidents
- MUST enable GitHub Advanced Security features on all repositories
RESPOND (RS) - Incident Response
- MUST execute incident management procedures
- MUST perform incident analysis and triage
- MUST report incidents per regulatory requirements
- MUST contain and mitigate incidents promptly
RECOVER (RC) - Recovery
- MUST execute incident recovery plans
- MUST communicate recovery status to stakeholders
- MUST incorporate lessons learned into improved procedures
Implementation Tiers
| Tier | Description | Hack23 Target |
|---|---|---|
| Tier 1 | Partial - Ad hoc responses | Not acceptable |
| Tier 2 | Risk Informed - Awareness exists | Minimum baseline |
| Tier 3 | Repeatable - Formal policies | Target for all projects |
| Tier 4 | Adaptive - Continuous improvement | Aspiration |
Hack23 ISMS Policy References
- Information Security Strategy - GV
- Information Security Policy - GV
- Risk Assessment Methodology - ID.RA
- Access Control Policy - PR.AC
- Cryptography Policy - PR.DS
- Secure Development Policy - PR.IP
- Vulnerability Management - DE.CM
- Incident Response Plan - RS
- Business Continuity Plan - RC
- Backup Recovery Policy - RC.RP
References
- NIST CSF 2.0: https://www.nist.gov/cyberframework
- NIST CSF Quick Start Guide: https://doi.org/10.6028/NIST.CSWP.29
When not to use it
- →When the project is not subject to security compliance
- →For non-Hack23 projects
Prerequisites
Limitations
- →Requires annual risk assessments
- →Tier 1 implementation is not acceptable
How it compares
Enforces a formal framework-based approach to security rather than ad-hoc control implementation.
Compared to similar skills
nist-csf side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| nist-csf (this skill) | 0 | 5mo | No flags | Advanced |
| reverse-engineering-tools | 73 | 4mo | No flags | Advanced |
| game-hacking-techniques | 42 | 2mo | No flags | Advanced |
| solidity-security | 15 | 2mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Hack23
View all by Hack23 →You might also like
reverse-engineering-tools
gmh5225
Guide for reverse engineering tools and techniques used in game security research. Use this skill when working with debuggers, disassemblers, memory analysis tools, binary analysis, or decompilers for game security research.
game-hacking-techniques
gmh5225
Guide for game hacking techniques and cheat development. Use this skill when researching memory manipulation, code injection, ESP/aimbot development, overlay rendering, or game exploitation methodologies.
solidity-security
wshobson
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
ghidra
mitsuhiko
Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.